Some car apps are slipping owners’ data to big tech companies

The app that comes with your car may be sharing what it knows about you with some of the biggest tech companies. Northeastern University researchers tested 21 vehicles and 30 carmaker apps and found some sending vehicle identification numbers (VINs), email addresses, phone numbers or location data to advertising, tracking and analytics companies.

The work was carried out with Consumer Reports, which gave them access to vehicles it had bought for testing. The 21 vehicles came from 19 brands.

Beyond reported cases such as the FTC enforcement action against General Motors, “relatively little is known about the privacy implications of the connected vehicle ecosystem,” the researchers wrote.

The setup behind the findings

The team connected each vehicle that supported Wi-Fi to an access point built on a Raspberry Pi and logged its traffic. The cars were tested while parked and untouched for 30 minutes, while parked as the team used doors, controls and infotainment menus for 30 minutes, and while driven on private roads at Consumer Reports’ test facility for 15 minutes.

(Source: Research paper)

All tested vehicles rejected the modified certificates the team injected to inspect encrypted traffic.”These results show that manufacturers are enforcing certificate validation,” the authors said. They recorded which domains each car contacted, along with the volume and timing of the traffic.

Vehicles can also send data over their own cellular connections, which the team could not intercept for most cars. To see whether traffic moved to Wi-Fi when the mobile signal was cut, they drove 11 electric vehicles into a Faraday tent, a shielded enclosure that blocks outside cellular signals from reaching the cars inside.

For the Tesla Model 3, which has a user-accessible SIM slot, they used a custom SIM card and ran their own LTE/5G network inside the tent. The authors said their results should be treated as a lower bound, since they could not decrypt vehicle traffic or see data shared on the server side.

Where the cars sent traffic

19 of the 21 vehicles contacted at least one third party over Wi-Fi. 11 contacted at least one domain linked to advertising, tracking or analytics. 13 of the 21 vehicles contacted Google-owned domains.

According to the paper, some of the domains observed, such as doubleclick.net and googlesyndication.com, were not needed for core services and are used for advertising.

The Tesla Model 3 contacted 34 unique advertising, tracking or analytics domains, the Tesla Cybertruck 23 and the Cadillac Lyriq 10.

10 vehicles, including the Buick Envista, Mercedes EQS and Land Rover Range Rover, contacted none over Wi-Fi.

Blocking the cellular signal revealed more destinations for seven of the 11 vehicles in the tent. The Tesla Model 3 contacted 27 more tracking-related domains inside the tent than outside it, and the Cybertruck 14 more. One analytics and tracking domain, conviva.com, appeared on the Model 3’s cellular connection and moved to Wi-Fi when cellular was blocked.

Apps add more trackers

70% of the apps contacted more than five unique advertising, tracking or analytics domains, compared to 29% of the vehicles.

“For most vehicles in our dataset, the companion app at least doubles cumulative ATA exposure,” the researchers explained, using ATA as shorthand for advertising, tracking and analytics.

The Buick Envista and Nissan Ariya, which had no direct contact with these companies over Wi-Fi, reached 20 or more advertising, tracking or analytics companies once their apps were included.

VINs, emails and location

7 of the 30 apps sent personal data to advertising, tracking or analytics companies. The study looked for VINs, license plate numbers, owners’ names, phone numbers and email addresses, location data, Wi-Fi network names and Wi-Fi passwords in decrypted app traffic, including hashed versions.

VINs were the most commonly shared item. GM’s myCadillac, myChevrolet, myBuick and myGMC apps sent the VIN to Adobe, Acxiom, ContentSquare, FullStory, Google, Meta, Microsoft, Pinterest, Snap and Yahoo. All four sent the owner’s email address to Adobe, and three of them also sent it to ContentSquare.

myCadillac and myGMC sent location data to ContentSquare, and myChevrolet sent it to Adobe. myGMC also sent the owner’s phone number to ContentSquare.

HondaLink sent the VIN and precise location to Amplitude, MyNISSAN sent the VIN and email address to Alchemer, and the Lincoln app sent the VIN to ContentSquare.

Advertising IDs on phones can be reset by users, while VINs “are subject to legal restrictions and cannot be changed,” the authors noted. Companies that receive a VIN along with other personal data can use them “to implement cross-context tracking of users,” linking a vehicle owner “with their behavioral data and purchase history from other websites and mobile apps,” they added.

Carmakers shift the responsibility to drivers

The researchers reviewed the privacy policies of the seven apps. Every manufacturer whose app shared personal data disclosed that it may share data with third parties. The policies did not name those third parties or the purposes.

GM, Lincoln and Nissan disclosed sharing VINs with third parties, and Nissan’s policy stated that sharing a VIN was more privacy preserving than sharing other unique identifiers.

The team disclosed its findings to 17 of the 18 manufacturers in the study and received 14 responses, while three did not reply. Fisker was not contacted because it went out of business before the outreach.

All responding manufacturers said the data flows matched their contracts with third-party service providers. Five said their apps open some links in an embedded browser, and that third parties on those web pages may collect data. Three of them said the pages ask users to accept or reject tracking cookies. Recordings made during the app tests showed this was not always the case.

Seven manufacturers said consumers are responsible for reading and accepting the terms for third-party software in the vehicle, including preinstalled software.

“The ongoing theme of all these responses was shifting the blame to the consumer,” the team notes on the project’s website. “The current system does not give owners the ability to choose.”

Owners who opt out get warnings. Tesla tells owners who decline its data sharing agreement that “this may result in your vehicle suffering from reduced functionality, serious damage, or inoperability.”

Honda was the only manufacturer that changed its practices in response to the findings. After the disclosure, Honda asked Amplitude to delete the location data it had received and updated HondaLink to stop sending geolocation to the company.

“Overall, our study revealed a large gap between what vehicle manufacturers publicly disclosed and how the connected vehicle ecosystem actually shares data over the Internet, which has explicit privacy implications. Based on the opaque nature of vehicular systems, we argue that there is a need for better transparency to ensure increased visibility into the entire ecosystem to identify and address corresponding harms,” researchers concluded.